Overview

overview

1

Static

static

xlsx/xlsx/...st.ps1

windows7_x64

1

xlsx/xlsx/...st.ps1

windows10-2004_x64

1

xlsx/xlsx/...st.ps1

windows7_x64

1

xlsx/xlsx/...st.ps1

windows10-2004_x64

1

xlsx/xlsx/...O.xlsx

windows7_x64

1

xlsx/xlsx/...O.xlsx

windows10-2004_x64

1

xlsx/xlsx/...J.xlsx

windows7_x64

1

xlsx/xlsx/...J.xlsx

windows10-2004_x64

1

xlsx/xlsx/...ck.ps1

windows7_x64

1

xlsx/xlsx/...ck.ps1

windows10-2004_x64

1

xlsx/xlsx/.../ga.js

windows7_x64

1

xlsx/xlsx/.../ga.js

windows10-2004_x64

1

xlsx/xlsx/...ery.js

windows7_x64

1

xlsx/xlsx/...ery.js

windows10-2004_x64

1

xlsx/xlsx/...pup.js

windows7_x64

1

xlsx/xlsx/...pup.js

windows10-2004_x64

1

xlsx/xlsx/...ins.js

windows7_x64

1

xlsx/xlsx/...ins.js

windows10-2004_x64

1

xlsx/xlsx/...e.html

windows7_x64

1

xlsx/xlsx/...e.html

windows10-2004_x64

1

xlsx/xlsx/...age.js

windows7_x64

1

xlsx/xlsx/...age.js

windows10-2004_x64

1

xlsx/xlsx/...ck.ps1

windows7_x64

1

xlsx/xlsx/...ck.ps1

windows10-2004_x64

1

xlsx/xlsx/...x.html

windows7_x64

1

xlsx/xlsx/...x.html

windows10-2004_x64

1

Analysis

  • max time kernel
    38s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-06-2022 07:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xlsx/xlsx/xl/link/Excel/BlackList.ps1

  • Size

    1KB

  • MD5

    d7a8ec808175f697f74fff16c97e2b11

  • SHA1

    102742cdeecb33034b74b24851c80570dbc2aa29

  • SHA256

    ac36b1a1ca21690705c69784f249175dee7355ee535d35913e8e46b6794454af

  • SHA512

    205cd939ef9aae19c60e5378b7b50ee84d78a23e22b6450e7b4b604f182c276571568a651223267d8ec442e5e4b29ae984572b83f6fdd89956a021d29ee1ca7e

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\xlsx\xlsx\xl\link\Excel\BlackList.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1984-54-0x000007FEFBC91000-0x000007FEFBC93000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1984-55-0x000007FEF3770000-0x000007FEF4193000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/1984-57-0x0000000002794000-0x0000000002797000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1984-56-0x000007FEF2C10000-0x000007FEF376D000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1984-58-0x000000000279B000-0x00000000027BA000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1984-59-0x0000000002794000-0x0000000002797000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1984-60-0x000000000279B000-0x00000000027BA000-memory.dmp
    Filesize

    124KB

    Download